Trail of Bits’ dimensional-analysis skill now checks the math a code comment calls correct

Trail of Bits merged version 3.1.0 of its dimensional-analysis skill, which hunts unit and decimal bugs in code like Solidity contracts. Its validator now traces the math even where a comment says the conversion is correct. If you audit DeFi code with it, a stale comment can no longer wave a bad formula through.

Version 3.0.3 told the validator to skip conversions that carried an explanatory comment, and edge cases the docs said were handled. Both exemptions are gone. A contract whose header calls it dimensionally sound now gets its dimensions traced like any other.

During testing, a contract carried a tag calling it dimensionally correct, and a run cleared the whole contract by quoting that tag instead of checking its arithmetic. Comments go stale, and a unit bug hiding under a reassuring comment is the one a reviewer is most likely to miss.

When the validator is unsure, it must still report the finding, downgraded and labelled needs review. A missed unit bug reaches the client, while a low note costs a reviewer a moment. Critical and high are kept for bugs whose dimensions it has traced.

Findings now cover unit mismatches, scaling errors and bad conversions only. Overflow, reentrancy, access control, denial of service and unchecked return values get one closing line at most, so general audit notes don't bury the unit bugs.

The old description waited for a request to annotate units or run a dimensional analysis. Now a request to review code for decimal mismatches, WAD and RAY scale errors, or the wrong token's decimals starts it too.

Bug detection used to start one validator per file. Now files are batched by call graph, so a single validator reads both sides of a call. A unit mismatch between two contracts is the kind most often missed when each side is checked alone.

The plugin now ships a test protocol, a cross-margin borrowing protocol with five planted bugs. Here a borrow index with 27 decimals goes through an 18-decimal helper, and only another file shows the index's scale. A correct staking contract sits beside it to catch false alarms.

The previous test put every bug in one contract, each with a giveaway nearby. Claude Sonnet found all five without the plugin, so the test couldn't tell the plugin apart from the bare model. The new one passes only with all five found and zero critical or high alarms on the correct contract.

The same workflow now runs in Codex as well as Claude Code, with five subagents that scan, discover units, annotate, propagate and validate. It needs a writable target and native agent dispatch. Version 3.1.0 ships the new test without a published score on it. The change is pull request 371 in the Trail of Bits skills repository.